Security in Electronic Commerce

Prof. Sanjay Verma

 Where are We?

E-Business
Business Serving
Model Customers

Web Site

Programming Application Content Site

Languages Development Management Design
Systems
Web Technologies

Application Internet E-Payment

Layer Security Systems
Internet Foundations
Lan Packet
Technologies TCP/IP
Switching
 Internet Security

Network Layer Security

Application Layer Security
System Security
 Network Layer Security

Packets might be
Modified in transit
May be spoofed
May contain bad payload.
Network layer security provides
Authentication and integrity
Confidentiality
Access control
 Application Layer Security

Safeguards built into a particular application.

Becomes more important as trust in network
layer security diminishes.
Provides
Authentication
Access Control
Confidentiality
Data integrity
Non-repudiation
 System Security

Protection of a particular end system by

Removal of known vulnerabilities (patching)
Minimal penetration risk configuration
Limits ports on which it listens
Limits services that run.
Authentication of downloaded software
Proper audit mechanisms
Up-to-date administration
Password changes enforced.
Guessable passwords are disallowed.
User accounts reflect needs.
 Firewalls

Border Router
First / last router under control of
system administration.
DMZ
Demilitarized zone.
Security is low, since not protected
by firewall. Locate webservers and
other services there that generate
potentially unsafe traffic.
Firewall
Filters packages based on a
variety of rules.
 Firewall Application Level Filtering

Packet filters only look at

The source address
The destination address
TCP / UDP port numbers
TCP / UDP flags.
Application filters deals with the details of the
service they are checking.
E.g. a mail application filter looks at
RFC 822 headers.
MIME attachments.
Might identify virus infected attachments.
 Firewall Application Level Filtering

Snort:
Allows to set up rules that pass a packet on to another service.
Commercial firewalls
Include application level filters for many products.
Use non-disclosure agreement to obtain proprietary protocols
 Proxy Firewalls

Proxies act on behalf of a client.

Proxy firewall
Reverse Proxy
Receives packages on one card.
Processes requests.
Translates them into internal requests on other card.
Receives answers from inside and translates to the outside.
 Proxy Firewalls

Proxy firewall
Forward Proxy
Receives requests from the inside.
Processes requests.
Translates them into requests to
the outside on other card.
Receives answers from outside
and translates to the inside.
Acts on behalf of inside machine
that is protected from the vagaries
of the internet.
Virtual Private Networks
 Virtual Private Networks

VPN uses connections over an existing public network

Connection secured with encryption
Host to Host
Host to Gateway
Gateway to Gateway
Virtual Private Networks
 Virtual Private Networks

Encryption can be done at

Application level.
Transport level.
Network level.
Data link level.
 Virtual Private Networks

Application Level
Pretty Good Privacy
Secure Shell (SSH)
Transport Level
Secure Socket Layer
Does not protect the package, but its content.
Typically runs at the application level of the OS, so OS does not need
to be changed.
Network Level
IPSec
Encrypts package itself.
Encrypted package receives a new package header.
IPSec protects port address, but not destination address.
OS need to be changed (but only once: Win2000, WinXP)
Data Link
Layer 2 Tunneling Protocol addition to Point-to-Point protocol
(PPP)
Encrypts packets on the data layer.
 Virtual Private Networks

Alternatives are dedicated point-to-point connections such as a private T1 line.

Most secure.
Most expensive.
Takes time to set-up.
 What Asha Pareek knows and does

What Asha What What

Pareek (Public) Bharat
knows and Prem (Manoj)
does Chopra sees Kumar
knows and
does
msg

Asha and Bharat do not

want Prem to know
about their messages
msg
 KeyAB
msg KeyAB

If messages were
KeyAB
handwritten, they would
have locked them in a msg
box and despatched
But How Can They Do This on
Internet?

A million question ?
 E-commerce Security Issues
Confidentiality A B

C
Authenticity A B

Integrity A B

C
 Code Meaning
Hat boat
Has been sent arrives
Friday tomorrow

This is coding, however we are interested

in cryptography and not coding
Cleartext ABC DE F GHI J KL M NOP QR S

Ciphertext d e f g h i j k l m n o p q r s t u v

hello KHOOR
 01 02 03 04 05 06 07 08 09 10 11 12 13 14 15 16 17 18 19
Cleartext A B C D E F G H I J K L M N O P Q R S

Ciphertext d e f G h i j k l m n o p q r s t u v

04 05 06 07 08 09 10 11 12 13 14 15 16 17 18 19 20 21 22
 KeyAB
msg KeyAB

KeyAB
msg
+KeyAB
msg {\\\\\}KeyAB {msg}KeyAB msg
 XOR
Pay Rs. 100/- 0+0=0
0+1=1
100 1+0=1
1+1=0

1100100 1100101
1100101 0000001

0000001 1100100
 Comparison of Time and Money Needed
to Break Different Length Keys
Length of key in bits

Cost 40 56 64 80 128

$ 100 thousand2 secs 35 hrs 1 yr 70000 yrs 1019 yrs

$1 million .2 secs 3.5 hrs 37 days 7000 yrs 1018 yrs

$100 million 2 msecs 2 mins 9 hrs 70 yrs 1016 yrs

$1 billion .2 msecs 13 secs 1 hr 7 yrs 1015 yrs

$100 billion 2*10-6 secs .1 sec 32 secs 24 days 1013 yrs

Applied Cryptography by Bruce Schneier

(2nd Edition , Hohn Wiley & Sons, 1996)
 Types of Cryptography

Symmetric Key

Asymmetric key
Symmetric Key Cryptography in
Real World: ATMs
Step 0
Provide Kcard/ATM and KATM/Bank to ATM
Bank should have KATM/Bank, your identification
and PIN
Your credit card should have your PIN and
identity
Identity What is PIN Transactions?
& PIN your
via card PIN?

BLOB

Information
The Key Management Problem

KAC KAB

KBC
 Kerberos
Identity

Password

Plaintext or Cleartext
 Step 0
What KDC
know and
KA does K
B

I am Asha I
want to talk
to Bharat
KA KB
What Asha
know and
does
What
Bharat
What Prem
know and
know and
does
does
 Step 1
What KDC
know and
does

I am Asha I
want to talk
to Bharat
KA KB
What Asha
know and
does
What
Bharat
What Prem
know and
I am Asha I know and
does
want to talk does
to Bharat
 Step 2
Bharats Ticket
Part Abr. Explanation
Asha The initial ticket requester
Bharat The end recipient of ticket
Time Stamp TS The time that KDC developed the
ticket
Time Duration TD Duration of validity of ticket
Session Key KAB Session Key
 Step 2
Ashas Ticket
Part Abr. Explanation
Asha The initial ticket requester
Bharat The end recipient of ticket
Time Stamp TS
The time that KDC developed the
ticket
Time Duration TD Duration of validity of ticket
Session Key KAB Session Key
Recipients Key {///} End Recipients Ticket
 Step 2: Asha receives two tickets
Ashas Ticket (decrypted using Ashas password)
Bharats Ticket (decrypted using Bharats password)

Step 3: Asha sends a message to Bharat

Asha sends a message (containing current time) +
Bharats ticket to Bharat

Step 4: Bharat decrypts Ashas message

Bharat receives the message and Processes it. Therefore
he gets current sessions key.

Step 5: Bharat composes a reply to Asha

 Step 6
Asha Receives and decrypts Bharats reply
Step 7
Asha and Bharat communicate in secure session
 Asymmetric Key Encryption

Public Key

Private Key
 The Process

A encrypts the message using Bs public

key. (everyone knows Bs public key)

A sends this message to B

`B decrypts the message using his private

key. (Only B knows his private key)
 The Process (revisited)

A encrypts the message using his own private key.

(Noone else knows As private key)

A encrypts the message using Bs public key.

(everyone knows Bs public key)

A sends this message to B

 The Process (revisited)

B decrypts the message using his private key.

(Only B knows his private key)

B decrypts the message using As public key key.

(Everyone knows As public key)
Check for Check for
Bharat for Bharat for
Rs. 10/- Rs. 10/-

Check for Check for

Bharat for Bharat for
Rs. 1/- Rs. 1/-
Check for Check for Check for
Bharat for Bharat for Bharat for
Rs. 10/- Rs. 10/- Rs. 10/-
 The concept of Checksums
Jasani Store

Maggie Rs. 10/-

Sauce Rs. 60/-
Bread Rs. 5/-

Total Rs. 75/-

 Digital signatures
A digital signature
Allows the receiver to authenticate the identity of the
sender

Prevents the sender from later claiming that he did not

sent the message

Prevents the receiver from constructing the message

that appears as if it came from the sender
 Digital signatures
Step 1: A encrypts the plaintext (PT1) to ciphertext (CT1) using Bs
public key
PT1 CT1
Step 2: A creates a message digest by hashing and then the digital
signature by encrypting the digest with As private key.
PT1 MD1 DS1
Step 3: A sends both the ciphertext (CT1) and digital signature (DS1)
to B. B receives both.
CT1 DS1 CT2 DS2
As end Bs end
 Digital signatures
Step 4: B decrypts ciphertext received in step 3 by using Bs private key to
get the original plaintext message.
CT2 PT2

How do we know PT2 = PT1?

Comparing PT1 and PT2 is not a wise thing.

Step 5: B obtains a message digest (MD2) by decrypting As digital

signature received in step 3 by using As public key. Hope MD1 = MD2.

Step 6: B creates its own message digest (MD3) using the same hashing
algorithm on the plaintext message (PT2). If MD2 = MD3 B concludes
that the message must have come from A and it has not been tempered
with.
 Digital Signature takes care of

Authentication

Message integrity

Non-repudiation
 Advantages and Disadvantages of Cryptographic Systems

Characteristic Symmetric Asymmetric

Key used Same key is used Two different keys

Speed of encryption/decryption Very fast Slower

Size of resulting encrypted text Usually same as or less More than the original plain
than the original size text size
Key agreement/exchange A big problem No problem

Number of keys required Equals about the square of Same as the number of
the number of participants, participants
so scalability is an issue

Usage Mainly for encryption and Can be used for encryption

decryption and decryption
(confidentiality), cannot be (confidentiality) as well as
used of DS (integrity and for DS (integrity and non-
non-repudiability) repudiability)
 The best of both worlds
The client generates a one time symmetric session
key with the help of certain cryptography
algorithms.

The client then encrypts the original clear text

message with one-time symmetric key to produce
ciphertext.

The client takes key one-time symmetric key and

and encrypts it with servers public key (key
wrapping).
 The best of both worlds

The encrypted symmetric key + ciphertext

message is encrypted again with servers public
key and sent to the server (digital envelope).

Rest of the steps can be guessed !

 Digital Certificates
The certification Authority
How do you generate a public/private key?
How do you inform everyone?
How do others know that the key sent by you is
actually sent by you?
Classes of certificates
Certification Revocation List
Online Certificate Validation Protocol
 How digital Certificates Work
Let us say that A wants to send his credit card
details to B. and A wants to verify that B is
actually B.
A will ask for digital certificate.
B will send this certificate to A. As we know
certificate will contain Bs identity, public key etc.
A can now send the message, encrypting it with
public key of B to B.
B will decrypt it with its private key.
A Digital Certificate include
1. Certificate owners identifying information

2. Certificate owners public key

3. Validity Date

4. Serial Number of the certificate

5. Name of the certificate issuer

6. Digital Signature of the issuer

 A Digital Certificate
Data:
Version: v3 (0x2)
Serial Number: 3 (0x3)
Signature Algorithm: PKCS #1 MD5 With RSA Encryption
Issuer: OU=Ace Certificate Authority, O=Ace Industry, C=US
Validity:
Not Before: Fri Oct 17 18:36:25 1997
Not After: Sun Oct 17 18:36:25 1999
Subject: CN=Jane Doe, OU=Finance, O=Ace Industry, C=US
Subject Public Key Info:
Algorithm: PKCS #1 RSA Encryption
Public Key:
Modulus:
43:7d:45:6d:71:4e:17:3d:f0:36:4b:5b:7f:a8
Public Exponent: 65537 (0x10001)
Signature
Algorithm: PKCS #1 MD5 With RSA Encryption
Signature:
6d:23:af:f3:d3:b6:7a:df:90:df:cd:7e:18:6c
Various Encryption Algorithms
AES
Blowfish
DES
ECC
IDEA
LUC Some important websites
MD? http://www.cca.gov.in/
RC?
RSA
SHA
3DES
 What are SSL and TLS?

SSL Secure Socket Layer

TLS Transport Layer Security
both provide a secure transport connection between applications (e.g., a web server and a
browser)
SSL was developed by Netscape
SSL version 3.0 has been implemented in many web browsers (e.g., Netscape Navigator
and MS Internet Explorer) and web servers and widely used on the Internet
SSL v3.0 was specified in an Internet Draft (1996)
it evolved into TLS specified in RFC 2246
TLS can be viewed as SSL v3.1

59
 SSL architecture

SSL SSL Change SSL

applications
Handshake Cipher Spec Alert
(e.g., HTTP)
Protocol Protocol Protocol

SSL Record Protocol

TCP

IP

60
SSL Handshake

61
Not-recognizable Certificate

62
 SSL

Client sends Send encryption

hello message algorithm and key length

Server responds
with hello
message
Send server certificate
Client sends containing servers public
response key

Server receives
Send client certificate and client response
encrypted private session and initiates
key sessions

Send data between client

Session and server using private, Session
shared key
 What is PGP?

PGP - Pretty Good Privacy

general purpose application to protect (encrypt and/or sign) files
can be used to protect e-mail messages
can be used by corporations as well as individuals
based on strong cryptographic algorithms (IDEA, RSA, SHA-1)
available free of charge at http://www.pgpi.org
first version developed by Phil Zimmermann
PGP is now on an Internet standards track (RFC 3156)
 PGP services

messages
authentication
confidentiality
compression
e-mail compatibility
segmentation and reassembly

key management
generation, distribution, and revocation of public/private keys
generation and transport of session keys and IVs
PGP / services